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Ping-Pong protocol is a type of quantum key distribution which makes use of two entangled 
photons in the EPR state. Its security is based on the randomization of the operations that Alice 
performs on the travel photon (qubit), and on the anti-correlation between the two photons in the 
EPR state. In this paper, we study the security of this protocol against some known quantum 
attacks, and present a scheme that may enhance its security to some degree. 
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I. INTRODUCTION 

In the early of 1990s, A. K. Ekert proposed a concep- 
tion of realizing quantum cryptography based on Bell's 
theorem pj], and C. H. Bennett and S. J. Wiesner brought 
forward a scheme for communicating via one- and two- 
particle operators on EPR states 0- Since then, how to 
use EPR pairs to distribute a key has become a signif- 
icant field of quantum key distribution (QKD) and has 
drawn physicists's attention. In 2002, Kim Bostrom and 
Timo Felbinger proposed a novel QKD protocol called 
'Ping-Pong' protocol [1], a number of works have been 
done in this aspect of QKD by far, some of them sug- 
gested improving security level of it, while others aimed 
at proposing eavesdropping schemes to attack it. In this 
letter, we discuss its robustness to some known quantum 
attacks in order to render a general description of this 
protocol. 

For the purpose, let us recapitulate the 'Ping-Pong' 
protocol: Bob prepares two photons in an entangled state 
\ip+) = ^(|0) |1> + |1) |0)). He keeps one of them (home 

photon), and sends the other (travel photon), to Alice 
through a quantum channel. After receiving the travel 
photon, Alice randomly switches between a control mode 
and a message mode. In the control mode, Alice mea- 
sures the travel photon with basis Bz = {|0) , |1)} and 
then announces her measurement result through a classi- 
cal public channel. After receiving the public announce- 
ment from Alice, Bob also switches to the control mode 
and measures the home photon with the same basis. In 
the absence of an eavesdropper. Eve, both the results 
should be anti-correlated, otherwise, it is an evidence 
that Eve is in line, the QKD process should be stopped. 
In the message mode, Alice performs a unitary operation 
to encode her message j G {0, 1} on the travel pho- 
ton, where = |0) (0| -I- (-)J |1) (1|. Then Alice sends 
the travel photon to Bob. Bob performs a measurement 
with a Bell basis to draw the information Alice encoded. 
If the measurement result is Bob knows that j — Q. 

Likewise, if the result is |^~), Bob knows that j ~ 1. 



Repeating the process above could transmit the classic 
bits that Alice would like to share with Bob, so the QKD 
is done. The security of Ping-Pong protocol is based on 
the randomization of the operations that Alice performs 
on the travel photon (qubit), and on the anti-correlation 
between the two photons in the EPR state. 

Compared to BB84 [4] and B92 ^Sj], Ping-Pong pro- 
tocol possesses a remarkable advantage: in the QKD 
process, it is unnecessary for Alice and Bob to discard 
some (may be a considerable amount of) unsuitable bits, 
so the efficiency of Ping-Pong protocol was ever thought 
of to be higher than BB84 and B92 by some researchers. 
However, 'how safe is it' is still a problem that needs to 
be solved. In the next three sections, I'll discuss this 
problem. 



II. TO OPAQUE EAVESDROPPING 

The opaque eavesdropping is the simplest attack, 
which is also called 'intercept-resend attack'. In this 
eavesdropping. Eve intercepts the quantum carrier on its 
way from Alice to Bob and/or from Bob to Alice and 
performs a measurement to get information about what 
state is sent and which operation Alice performs to the 
travel photon. Fig.l demonstrates Eve's eavesdropping 
process. 
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FIG. 1: The process of Eve's eavesdropping. 

Ping-Pong protocol itself plus this opaque eavesdrop- 
ping could be described as follows: 

(1) At first, Bob prepares a pair of photons in |-;/;+) — 
^(|0) |1) + |1) |0)). Assuming that Eve is absent, then 
after Alice's opration on the travel photon(Z° with the 
probability Po, and Z^ with pi), the state of the pair 
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becomes 

(1) 

(2) When Eve is in line, she captures the travel photon 
from Bob to Alice, and performs a projective measure- 
ment on it. Assuming Eve gets |0), the home qubit at 
Bob's hand becomes Then Eve prepares another |0) 
and sends it to Alice. Alice operates (with po) or 

(with pi) to the qubit. However, neither Z^ nor Z^ 
could change |0). After that, Alice returns the qubit, and 
Eve captures it. But Eve could not get any information 
by performing measurement on it because it remains un- 
changed. At last. Bob receives the travel qubit and the fi- 
nal state of the pair reads |0)(. In this case, the prob- 
ability that Bob gets the wrong information, i.e. QBER, 
could be expressed as = 1 — |(V'"|10)|^ = \ — sfp^pl = 

\ + \/Po(l-Po)- 

(3) Similarly, The case that Eve gets |1) when she per- 
forms measurement on the qubit from Bob to Eve can 
be analyzed analogously as above. But the QBER is 

«i = 5 - \/Po(l-Po)- 

Since the probability that Eve gets |0) or |1) is 50% 

respectively, the statistical QBER is g = = i. In 



this case, the capacity of the channel, i.e. the maximal 
information between Alice and Bob, can be calculated to 
be 

Iab = 1 + 9log2 9 + (1 - q) log2(l - g) = 0. (2) 

From the analysis above, one can come to a conclusion 
that opaque eavesdropping is unskilled to Ping- Pong pro- 
tocol, because it could make neither Eve nor Bob obtain 
any information, and in addition, it may cause a QBER 
up to 50%. As a result, a wise eavesdropper would not 
use it, so Ping-Pong protocol is robust to opaque attack. 

III. TO TRANSLUCENT EAVESDROPPING 

We will still follow the process in Sec. II (sec Fig.l). 
In the following analysis, we make an assumption that 
measurements do not make photons disappear, although 
with current technology, a photon disappears after it is 
measured. In fact, if the photon disappears, the analysis 
in this section would degenerate to that in Sec. II. 

(1) Bob prepares a pair of qubits in [V/"') = \(\)^) = 
-^(|0)^ -|- |0)j), and sends one of them to Alice. 

(2) Eve captures the travel qubit, and makes it interact 
with an ancilla |x), obtaining 



= (y^io). + V? II)/.) io)* ixo) + (/f 10)/. + II)/.) ii)t Ixi)) 

I 



(3) 



J 



in which D is the probability of error, and F -\- D = \. Thus the reduced density matrix of the ancilla and travel 
qubit reads 

/ 1 2^D(\-D) \ 

1 

2 
V 2v'D(l - D) 1 } 

I 



Pat — '■' 



(4) 



(3) Eve continues to pass the travel qubit to Alice. If mode', performing Z° with and Z^ with = 1 — p^,, 
Alice chooses 'control mode', she would detect out Eve the state of the ancilla and travel qubit would become 
with a probability D. Else, if Alice chooses 'message 



= io),[VT(vp;:+v^)io)Jxo) + yf(vi^-Vpr)|i)tix.)] • (s) 

+ \^)h [^(Vp^ + Vp:) I0)t Ixc) + sJiiVTo-^.) lxx>] 
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The density matrix is 



(2) 
Pat 



2 + ^/PoP'^ 





(p„ 










\{p,^p,)^D{l-D) 



(6) 



whose eigenvalues are as follows 

Ai = Aa = 0^ 

A3 = i + ^p„p,+{j>„~p,fD{l~D) , (7) 
A4 - i - ^p,p,+{p,~p,YD{l~D). 

Thus the maximum information Eve could get can be 
calculated as ^ 

4 

Iae = - ^^i log2 Ai = - A3 log2 A3 - A4 log2 A4. (8) 



In fact, the density matrix of the whole system (ancilla, 
home and travel qubit) reads 



D 





{p,-p,)^D{l-D) VDil-D) 








ip„-pJ^D{l-D) 
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V {P,-P,)D ^D{l-D) {p,^p,)^D{l-D) 



pJ^D{l-D) 


D 



(9) 



(4) The travel qubit is sent back by Alice and captured 
again by Eve. Now, Eve could perform a measurement 
on the two qubits: ancilla and the travel one. In this 
case, this qubit pair is in the EPR state in the subspace 
of the two qubits, thus a Bell measurement could help 
Eve get the information about which operation Alice has 
performed on the travel one. Eve makes use of two Bell 
basis- vectors for the measurement: 



bit) 



^(|0)JXo) 
) = 7l(|0)JXo) 



+ |i>Jx.)) 
-|i>Jx.))- 



(10) 



So the probability of Alice's operation that Eve obtains 
could be calculated as 



P{I) = 
p{Z) = {i 



Pat 
Pat 



'^at 
^'at 



) = 



fa, -pj /D(T^ 
-{p„~p,)^Dil-D). 



(11) 

After Eve's Bell measurement, the subsystem of home 
and travel qubits becomes 



/ l + WPoi^-Po)i^D-l) ^^D{l-D) 



i + iVPo(l-Po)(2^-l) yD{l-D) 

i/D(T~D) i-5v/Po(l-Po)(2i?-l) 

V ^^D{l-D) i-5VPo(l-Po)(2i?-l)y 

I m 

Note that D + F = 1 and p,, + p-^ ^ 1. (5) Eve sends the travel qubit back to Bob. Statis- 
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tically, Bob uses performs measurements on both home 
and travel qubits, and the QBER of Bob's measurements 
is 

9=1- (^"1 Ptt W) = J - Po(l - Po)(2^ - !)■ (13) 

Thus, the maximum mutual information between Alice 
and Bob (i.e. the capacity of this quantum channel) is 



Iab = 1 + glog2 9 + (1 - g) log2(l - q). (14) 
We plot Iae and Iab in the figure below: 




FIG. 2; The comparison of Iab and Iae- 



From the Fig. 2, we can come to a conclusion that when 
Alice conducts an equiprobable coding, that is to say, 
— — ^, which is also the security requirement of 
classical cryptography [12,], Bob could always gets more 
information than Eve, especially in the case of 13 = 
(Eve's optimal eavesdropping), Alice and Bob can share 
the maximum information {Iab — 1), and Eve gets the 
minimum information {Iae = 0). Thus, in short, as long 
as Alice codes the travel qubits equiprobably, the Ping- 
Pong protocol is secure. 

IV. TO WOJCIK'S ATTACK 

In 2003, Antoni Wojcik proposed a novel eavesdrop- 
ping scheme to attack Ping-Pong protocol Q, claiming 
that if the quantum channel transmission efficiency 77 is 
no more than 60%, Eve could get more information than 
Iab without being detected. By far, there is no effec- 
tive preventing method against this attack. We propose 
a so-called Disguising Photon Detecting (DPD) method 
to implement this task, because in our scheme, we use 
some single photons in the state |+) = -^(|0) -I- |1)) dis- 
guising the travel photons in the original Ping-Pong pro- 
tocol. The disguising photon can be called a 'false pho- 
ton', and correspondingly, the travel photon entangled 



with another one in the state \ip+) = -75(10) |1) |1) |0)) 

in the original Ping-Pong protocol Q is called a 'true 
photon'. In the DPD method, the original Ping-Pong 
protocol has to be modified: Bob randomly sends Alice 
a travel photon that is a true or false photon. After re- 
ceiving the travel photon, Alice switches between control 
mode and message mode, and then goes ahead just as 
in the original Ping-Pong protocol. But after Bob re- 
ceiving the traveling-back photon, what he should do is 
somewhat different from that in the original Ping-Pong 
protocol. If he sends a true photon, he then take the 
same action on the traveling-back photon just as what 
he should do in the original Ping-Pong protocol; else, 
if he sends a false photon and Alice chooses the mes- 
sage mode, after receiving the traveling-back photon, he 
asks Alice which operation she performed on the pho- 
ton, or , if Alice performed Bob does noth- 
ing to the traveling-back photon and discard it, while if 
Alice performed Z^, Bob performs a projective measure- 
ment on the traveling-back photon with the projector 
P+ - 1+) (+1 = i(|0) + |1))((0| + (1 1) which could be 
done by using some optical devices 0,11,0; else, if Bob 
sends a false photon and Alice chooses the control mode. 
Bob tells Alice to discard this bit in the authentication 
step after sending all the photons. 

Theoretically, if Eve is absent, the false photon af- 
ter being performed must be in the state |— ) = 
-^(|0) — |1), so the outcome of the measurement must 

be zero, because |— ) is orthogonal to |+). But if the 
outcome is not zero, it could be an evidence that Eve 
is eavesdropping the communication between Alice and 
Bob, thus the QKD process must be stopped. 

To demonstrate this method is feasible, let us now an- 
alyze the states that Bob sends and receives. The initial 
state that Bob sends is |+) = -^(|0)-(-|l)), whose density 
matrix is 

Pt = \+) (+1 = ^(io) (oi+io) (ii+ii) (oi+ii) (ii) =\(^\\y 

(15) 

There are two situations that should be considered: 
(1) When Wojcik's Eve is in hue. After Eve's B-A at- 
tack, the state becomes \B-A) — Qtxy \+)t k'^^)^ |0)^ — 
i(|0), |0), \vac)^ + \vac), |0), |1)^) + i(|mc), |1), |0)^ + 
|l)t 11)2: b^*^);/)- If Alice performs Z'^ (that is, an iden- 
tical operation /), the state maintains in \B-A), then 
Alice sends it back and Eve commits the A-B attack 
Q^Jy (according to transformations (3) in Wojcik's pa- 
per i): \A-B), = Q^JyI\B-A) - -i=(|0)Jmc) JO)^ + 
|l)t |0)j^ = \+)t\vac)^\0)y), where the subscript 

/ indicates that Alice performs I = Z^. So the 
travel photon Bob receives would be still in the 
state |-t-). Else, if Alice performs Z^ (that is, the 
Pauli cTz operation), the state becomes ctz \B-A) = 
i(|0), |0), \vac)^ + \vac), |0), |1)^) -I- i(|mc), |1), |0)^ - 
|l)t |l)a; Then Alice sends the photon back 

and Eve commits the A-B attack Q^Jy'. \A-B) ^ = 
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0,->. \B-A) = ^ |0), |mc), |0),^ + ^ |mc), 
where the subscript Z indicates that Ahce performs 
Z — Z^. So the density matrix of the false photon is 

p^^ = Tr^.y \A-B)z z {A-B\ = i |0) (0| + i |1) (1| (16) 

where the subscript 't' denotes the travel photon. This 
means that the false photon Bob receives is in either |0) 
or |1) with the probability of 1/2 respectively. 

(2) When Wojcik's Eve is absent. If Alice performs Z^ 
on the false photon and sends it back, Bob would receives 
the photon in |+). Else, if Alice performs Z^, the photon 
Bob receives would be in Z^ |+) = |— ). 

It could be concluded from the analysis above that 
if Alice performs Z° on the false photon, no matter 
Wojcik's Eve is in line or not. Bob would receive the 
photon in |+), which is not able to be used to detect Eve. 
But if Alice performs Z^, the case is different: when Eve 
is in line, Bob would receives the photon in either |0) or 
|1); when Eve is absent. Bob would receives the photon 
in |— ). With this difference, to detect Wojcik's Eve is 
possible, and we propose a projector P+ could fulfill this 
task. 



V. DISCUSSION AND COMMENT 

In 2003, Qing-yu Cai published his comment claiming 
that the Ping-Pong protocol can be attacked without 
eavesdropping [To| . In the comment, Cai proposed 
that Eve could attack the communication between 
Alice and Bob with the following method: 'In every 
message mode, Eve captures the travel back qubit Alice 
sent to Bob and perform a measurement in the basis 
Bz and forwards to Bob this qubit. Alice and Bob 
have zero probability to find Eve's attack. Then Bob 
lets this communication continue. But every one of 
Bob's measurement results is meaningless since the two 
qubits become independent of each other after Eve's 
attack measurement. . . . When the communication is 
terminated, Bob has learned nothing but a sequence of 



nonsense random bits.'' However, we think this attack 
would not work as well as claimed for at least two 
reasons: (1), when Eve performs a measurement on 
the qubit travelling from Alice to Bob, the entangle- 
ment between the home qubit and the travel qubit is 
destroyed, it is no longer 1-0+) = ^jdO) |1> + |1) |0)) 

or IV") = ^(|0) |1) - |1) |0)), but simply |01) or |10), 
which could be detected by a Bell measurement, and 
Eve could not gain any useful information about what 
operation Alice performs on the travel qubit; (2), after 
terminating the QKD process, Alice and Bob would 
pick out a part of the key established in the process to 
make a classic authentication, if the attack makes Bob's 
measurement results meaningless, it would be found 
that Eve is in line in the classic authentication. As a 
result, Cai's claim that the Ping-Pong protocol can be 
attacked without eavesdropping is open to doubt. 



VI. CONCLUSION 

In this letter, we analyze the robustness of Ping-Pong 
protocol to some known quantum attacks, from the anal- 
ysis, we can come to the conclusion that, to opaque and 
translucent attacks, Ping-Pong protocol is robust and se- 
cure, and to Wojcik's attack, as long as Bob sends suffi- 
cient disguising photons, he could make this attack use- 
less. In summary, the Ping-Pong protocol is secure as 
long as it is modified to use the DPD method. We call 
the Ping-Pong protocol associated with the DPD method 
a modified Ping-Pong protocol, of which process may not 
be depicted clearly in words, so it would be necessary and 
beneficial to describe it in a chart. Thus, we draw a flow 
chart to make the modified Ping-Ping protocol more clear 
to be understood. See FigO 
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Bob sends a travel photon to Alicer * 




Alice measures the travel 
photon in the basis = 
{ i 0>, i 1>} and teils Bob 
the result. 



Alice first performs a i 
operation on the travel 
photon (/ = or 1) and 
send It l>ack to Bob. 



Alice measures the travel 
photon in the basis = 
{ i 0>, i 1>} and teils Bob 
the result. 



Alice first performs a t 
operation on the travel 
photon (/ = or 1) and 
sends it baci( to Bob. 



Bob receives the travel photon and 
asks Alice about /through a classical 
channel. Alice replies Bob . 




Bob performs a projective 
measurement on the travel 
photon with = l+x+l. 



Eve is In line. Stop the QKD process. 



FIG. 3: The flow chart of the modified Ping-Pong protocol. 



